NetFlow Analyzer

When facing complaints from network users, determining that the network is the cause is just the beginning of the troubleshooting process. Homing in on the specific issue can require answering the following questions:

• When did the issue start?
• Is the issue constant or intermittent?
• Is the device on the enterprise network or working from home?
• Does the device have a wired or wireless connection?
• Is the issue all applications or a particular one?
• Is there a specific part of the application that is slower? For instance, when you login?
• Are there other users experiencing similar issues with that application or in the same part of the network?

Traditional network management solutions often only provide information about whether the network is congested or if there are physical level errors, not giving much visibility above layer 2. Information like the source and destination IP addresses causing the problem is unavailable in these tools.

Tools that collect and graph interface statistics may not provide enough information to isolate the root cause. Interface thresholds, alarms, and traps are the equivalent of the dashboard lights in your car telling you something is wrong but no real information about what. Packet capture tools can help identify these addresses, but they are often expensive, difficult to maintain, and not deployed at all sites. With some luck, one can locate a bandwidth hog by examining switch ports, application statistics, or web proxy logs.

Network flow monitoring tools like NetFlow can fill in these gaps by providing deep network visibility, making it easier to see where and how your network is performing or not performing.

While NetFlow and its variants sFlow and IPFix have been around a comparatively long time in technology years, they have not been utilized as widely as they could be. There are several reasons for this slow adoption:  

One of the advantages of utilizing NetFlow or another network flow source is that your network devices likely include support already—you will just need to activate it and point its output to a collector. If, by chance, your devices don't offer it, adding it is a reasonably low lift: you rarely need new hardware, and it’s relatively easy to configure with no downtime.

The resources consumed while active are low also; despite the concern listed above, the bandwidth required to export NetFlow data is usually less than 0.5% of total bandwidth consumption, and sampled NetFlow is an option for high data volumes.

In the typical network monitoring configuration, OpenNMS acts as NetFlow analyzer. Its classification engine can categorize flows according to a set of rules which define over 6200 applications for basic communication protocols. Users can also create their own classifications based on IP, port, protocol and exporter.

With OpenNMS NetFlow analyzer, you can also set thresholds to identify if a classified application is running above or below a stipulated amount to quickly establish if an application is working properly. A good example might be a video camera that is always sending data: you could set up a “low” threshold that checks to see that the camera is sending data to the network video recorder.

OpenNMS also enriches flow data by tying in the other information OpenNMS collects, such as SNMP-based interface statistics. This allows users to pivot across the environment as you chase a problem around. And users can send these flows via Kafka to other security tools to process the data. For highly secure or other difficult to reach network segments, OpenNMS core and minion can also be utilized as a flow collector in the network flow monitoring set up so you can gather and analyze information across your whole network.

Overall, utilizing OpenNMS as your NetFlow Analyzer offers several benefits that help overcome the challenges of using network flow information, including: